deploy: publish site on host port 1337; nginx proxies /api/contact; auto-deploy

- site nginx listens on 1337; proxies /api/contact to the relay over the internal
  network (single public port; TLS terminates upstream at Cloudflare)
- trailing-slash rewrite moved inside location / so /api/contact isn't redirected
- compose: publish ${SITE_PORT:-1337}, internal bridge network, no Traefik labels
  (non-destructive — does not touch the WordPress apex router)
- .gitea/workflows/deploy.yml: on push to main, runner rebuilds + restarts the stack

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/.env.example

@@ -14,7 +14,6 @@ RELAY_WINDOW_SECONDS=600
 # --- Site build ---
 PUBLIC_SITE_URL=https://cesnimda.co.uk
 
-# --- Infra (Traefik host reverse proxy) ---
-PROXY_NETWORK=traefik_proxy       # existing external Traefik docker network
-SITE_HOST=cesnimda.co.uk          # Host rule for the Traefik routers
-TRAEFIK_ENTRYPOINT=websecure-external  # Traefik entrypoint name on the host
+# --- Infra ---
+SITE_PORT=1337           # host port the public-facing site is published on
+                         # (put Cloudflare / your TLS proxy in front of it)